How to use KQL or Az Powershell/CLI to retrieve data

Question

Hi, I have a few questions that would need some guidance.

1. Is there KQL query or Az commands to retrieve RBAC actions more than 90 days?
2. Can logic apps retrieve the subscription IAM access creation date more than 90 days?

Thank you in advance!

Answer 1

You can extend the 90 days by configuring Export Activity Logs in the Activity Log, and increasing the total retention period.

You can opt to increase the interactive retention, which allows you to maintain standard KQL Log Analytics query methods.

Or the total retention through archive;

Once you have done this you can query data in the archive period through using a Search Job.

NB: You can access archived data by running a search job or restoring archived logs. REF